Install Jentic One Beta

Connect the ExternalIdentities to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the ExternalIdentities, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazureadb2c%2Fazureadb2c" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazureadb2c%2Fazureadb2c" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with ExternalIdentities API.

Create and manage Azure AD B2C tenant resources scoped to a subscription and resource group

Provision Azure AD for Customers (CIAM) directories for new customer-facing identity stacks

Check whether a B2C or CIAM tenant name is available before attempting to create one

List and inspect Guest Usages resources to track external collaboration

GET STARTED

Start building with ExternalIdentities API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use ExternalIdentities API for, with concrete tasks.

★ Provision a customer-facing identity stack

Stand up a new Azure AD B2C or Azure AD for Customers tenant as part of launching a new product. The API supports name availability checks before creation and full lifecycle on b2cDirectories and ciamDirectories so the whole flow can be scripted from infrastructure-as-code.

Check availability of contoso-b2c via checkNameAvailability and, if free, create a B2C tenant named contoso-b2c in resource group identity-rg.

Tenant inventory and ownership audit

Inventory every B2C and CIAM directory across an Azure subscription to confirm ownership, region, and SKU. The list-by-subscription endpoints make it possible to feed governance dashboards with directory metadata without manual portal sweeps.

List all b2cDirectories and ciamDirectories in subscription 00000000-0000-0000-0000-000000000000 and report each one's SKU and location.

Guest collaboration usage reporting

Track Guest Usages resources across a subscription to understand external collaboration and Azure AD B2B traffic. The guestUsages endpoints expose per-tenant resource records that finance and IT teams can use for billing and policy enforcement.

List all guestUsages resources in subscription 00000000-0000-0000-0000-000000000000 and return the tenants with non-zero monthly active users.

Agent-driven identity provisioning

Let an AI agent take a request like 'spin up a new B2C tenant for project X' and run name availability, tenant creation, and a CIAM directory in parallel through Jentic. Surfacing the ExternalIdentities operations as agent tools turns identity provisioning into a chat-driven workflow.

Search Jentic for 'check azure ad b2c tenant name availability', load the schema, and execute it for the candidate name 'contoso-b2c'.

Key Endpoints

20 endpoints — the azure ad b2c externalidentities api manages the arm resources behind azure ad b2c tenants, guest usages, and azure ad for customers (ciam) directories.

METHOD

PATH

DESCRIPTION

POST

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/checkNameAvailability

Check B2C/CIAM tenant name availability

GET

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/b2cDirectories

List B2C directories in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/b2cDirectories/{resourceName}

Get a B2C directory by name

GET

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/ciamDirectories

List CIAM directories in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/ciamDirectories/{resourceName}

Get a CIAM directory by name

GET

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/guestUsages

List Guest Usages across the subscription

GET

/providers/Microsoft.AzureActiveDirectory/operations

List available AzureActiveDirectory operations

POST

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/checkNameAvailability

Check B2C/CIAM tenant name availability

GET

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/b2cDirectories

List B2C directories in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/b2cDirectories/{resourceName}

Get a B2C directory by name

GET

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/ciamDirectories

List CIAM directories in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/ciamDirectories/{resourceName}

Get a CIAM directory by name

GET

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/guestUsages

List Guest Usages across the subscription

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Provisioning Azure AD B2C and CIAM directories by hand means acquiring Azure Active Directory OAuth 2.0 tokens, targeting the management.azure.com ARM control plane, and threading subscription, resource group, and tenant names through every Microsoft.AzureActiveDirectory path yourself. Through Jentic you install once, import ExternalIdentities from the API Directory, store the Azure AD credential once, and your agent calls it.

Permission scoping

This API carries the subscription, resource group, and directory name in the URL path (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/b2cDirectories/{resourceName}), so a rule can pin your agent to one directory or resource group and nothing else. You choose the operations it may call, so tenant deletion is not included unless you add it.

Credential isolation

Your Azure AD token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'create an Azure AD B2C tenant' or 'list CIAM directories in a subscription', and Jentic returns the matching b2cDirectories or ciamDirectories operation with its input schema so the agent calls the right ARM endpoint without browsing Microsoft docs.

FAQs

Specific to using ExternalIdentities API through Jentic.

What authentication does the Azure AD B2C ExternalIdentities API use?

The API uses Azure Active Directory OAuth 2.0 via the implicit flow scheme `azure_auth`, scoped to user_impersonation against https://management.azure.com. Through Jentic the OAuth token stays in the vault and only short-lived scoped bearer tokens are exposed to the agent.

Can I create a new B2C tenant with this API?

Yes. PUT on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/b2cDirectories/{resourceName} creates or updates a B2C tenant. Combine it with a checkNameAvailability call first to confirm the requested name is free.

What are the rate limits for this API?

The spec does not declare explicit rate limits. Calls go through Azure Resource Manager, which applies standard ARM throttling per subscription. Inspect the x-ms-ratelimit-remaining-subscription-* response headers to track quota.

How do I check tenant name availability through Jentic?

Search Jentic for 'check azure ad b2c tenant name availability', load the schema for POST /subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/checkNameAvailability, and execute it with the candidate name. Install with `pip install jentic` and use the async search/load/execute pattern.

What is the difference between b2cDirectories and ciamDirectories?

b2cDirectories manage classic Azure AD B2C tenants. ciamDirectories manage the newer Azure AD for Customers (CIAM) resource type, which is Microsoft's next-generation customer identity offering. The API supports both so you can pick whichever model fits the product.

Does this API manage user accounts inside a B2C tenant?

No. This API only manages the tenant resource itself. User accounts, custom policies, identity providers, and sign-in flows inside a B2C tenant are managed via the Microsoft Graph API and the B2C policy framework, not through this ARM surface.

Can I limit what my agent is allowed to do with the Azure AD B2C API?

Yes. Because you self-host Jentic One, your own rules decide which operations and credentials the agent may use, and every path in this API carries the subscription, resource group, and directory name (for example /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/b2cDirectories/{resourceName}), so you can pin the agent to a single directory or resource group and nothing else. You also choose the exact operations it may call, so you can allow read-only work like checkNameAvailability and listing b2cDirectories or ciamDirectories while leaving tenant creation or deletion out entirely. The stored Azure AD token stays inside your own instance and is injected only at execution, never reaching the agent's prompt or logs.

Azureadb2c ExternalIdentities

Name: ExternalIdentities API
Brand: ExternalIdentities
Availability: InStock

Official vendor OpenAPI document · agent-readyIdentity AuthDirectory Servicesoauth220 EndpointsREST

For Agents

Provision Azure AD B2C tenants, manage Azure AD for Customers (CIAM) directories, and track Guest Usages from one ARM-based identity surface.

Use for: Create a new Azure AD B2C tenant in my subscription, Check if a B2C tenant name is available, List all Azure AD B2C directories in my subscription, Provision an Azure AD for Customers CIAM directory

Not supported: Does not manage users, custom policies, or identity providers inside a B2C tenant - use only for the ARM-level lifecycle of B2C tenants, CIAM directories, and Guest Usages.

The Azure AD B2C ExternalIdentities API manages the ARM resources behind Azure AD B2C tenants, Guest Usages, and Azure AD for Customers (CIAM) directories. It exposes 20 operations across 11 resource paths under the Microsoft.AzureActiveDirectory provider, covering tenant create-or-update, listing tenants per subscription or resource group, name availability checks, guest usage tracking, and CIAM directory lifecycle. Use it to provision new B2C or CIAM directories, audit guest collaboration usage, and check tenant name availability before creation.

Jentic One on Github View OpenAPI Document